CVE-2026-43908: OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder
Last updated 21 May 2026
Other sources
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression i 3 inside ConvertCbYCrYToRGB() causes the function to compute a large negative pointer offset into the output buffer, producing an out-of-bounds write that crashes the process. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openimageioto a version that resolves this vulnerability.Fixed in 3.0.18.0 - Upgrade
Upgrade
debian/openimageioto a version that resolves this vulnerability.Fixed in 3.1.13.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43908?
CVE-2026-43908 has been classified as a high severity vulnerability due to the potential for heap out-of-bounds writes.
How do I fix CVE-2026-43908?
To mitigate CVE-2026-43908, upgrade to OpenImageIO version 3.0.18.0 or 3.1.13.0 or later.
What software is affected by CVE-2026-43908?
CVE-2026-43908 affects OpenImageIO versions prior to 3.0.18.0 and 3.1.13.0.
What type of vulnerability is CVE-2026-43908?
CVE-2026-43908 is a signed integer overflow vulnerability that can lead to heap out-of-bounds writes.
Can CVE-2026-43908 be exploited remotely?
Yes, CVE-2026-43908 could be exploited remotely if an attacker can manipulate the DPX 4:2:2 decoder input.